// legal
Privacy Policy
What we collect, why, with whom, and for how long — for the website and the client portal alike.
Data controller
The processing described here is carried out by Hacktiv' Studio, a sole trader registered under SIREN number 918 924 382, with its registered office at 6 rue Hoche, 81400 Carmaux, France.
Controller: Romain AMERICA. For any question about your data: contact@hacktiv-studio.fr.
What this document covers
Two distinct services, described together because the same person operates both.
The website hacktiv-studio.fr — public, readable without an account.
The client portal portal.hacktiv-studio.fr — the workspace supporting NF525 certification, open to client companies and the people they invite.
They do not collect the same data and do not keep it for the same time; each section below says which of the two it concerns.
The website — what is collected
The contact form. What you enter there is used to answer you, and for nothing else. It is never sold, shared, or used for third-party marketing.
Audience measurement. The site uses Cloudflare Web Analytics, which counts page views without setting a cookie and without building an individual profile. No advertising tool, no embedded social network, no third-party tracker.
The portal — what is collected
For your organisation: its registered name.
For each account: an email address, and a password that is never stored as such — only an Argon2id fingerprint is kept, from which the password cannot be recovered.
For each appointment: the name, email address, and where given the phone number, company and time zone of the person booking, along with the names and addresses of the attendees they add.
To which are added the documents and reports you upload or that the engagement produces.
What is not collected
This section exists because it is as informative as the one above it.
Calendar contents are never read. To offer free slots, the portal asks Google Calendar for busy periods only — time intervals. It receives no title, no attendee and no description of any appointment, including those that have nothing to do with Hacktiv' Studio. That choice is built into the design of the service, not merely into its settings.
Password reset links are not stored. Only a fingerprint of the emailed link is kept, long enough to verify the one you present.
No data is used for profiling, and none is subject to automated decision-making.
Why, and on what basis
Performance of the contract — accounts, bookings, appointments, audit documents, invoicing: without this data the service cannot be delivered.
Legal obligation — accounting records and invoices, whose retention period is set by the French Commercial Code.
Legitimate interest — answering a contact request, measuring site audience anonymously, and keeping technical access logs for the security of the service.
Who else has access
The list is short, and it is complete.
OVH (France) — hosting for the website, the portal and their databases.
Google — Calendar and Meet, to create an appointment's calendar event and its meeting link. What is sent is the time, the name of the service booked, and the invited attendee's address.
Cloudflare — two distinct uses: site audience measurement, without cookies; and the anti-bot check protecting the contact form, which inspects your IP address and technical browser signals long enough to establish that you are not an automated client.
Email passes through no third party: it is sent by a mail server operated by Hacktiv' Studio. No data is transferred outside the European Union beyond what Google and Cloudflare operate under their own contractual safeguards.
For how long
Contact messages — 3 years after the last exchange.
Client accounts and engagement data — for the duration of the contract, then 3 years.
Appointments and calendar events — 3 years after the appointment date.
Invoices and accounting records — 10 years, as required by article L123-22 of the French Commercial Code.
Technical logs — 12 months.
After these periods the data is deleted or anonymised. Data subject to a legal retention obligation cannot be erased before its term, including on request.
Your rights
You have the right to access, rectify, erase, restrict, object to, and port the data concerning you.
These are exercised by writing to contact@hacktiv-studio.fr. You will receive an answer within one month.
If that answer does not satisfy you, you may lodge a complaint with the CNIL, the French supervisory authority.
Cookies
Browsing this site sets no cookie. Its audience measurement works without cookies and without a persistent identifier, and the only cookie the domain itself issues authenticates the site's administrator — it concerns no visitor.
One exception, and it is technical: on the contact page, Cloudflare's anti-bot check may set a short-lived cookie when it runs a verification. It exists so you are not asked again, and for nothing else.
The client portal does use a session cookie to keep you signed in. It is strictly technical, expires with your session, and is used for no measurement and no tracking.
Last updated: 31 August 2026.